000038104 - What is the network encryption method of RSA NetWitness Platform and how to change the cipher of it?

In RSA NetWitness Platform 11.x, what is the network encryption method used on individual port? And how to choose or restrict the cipher?

Network encryption method

Administrators can click the ports on and off to support only SSL, only non-SSL, or both.
But Reporting engine service has only non-SSL port 51113.

Encryption cipher configuration and How to choose or restrict the cipher suites?

Web server: 

It is configured at /etc/nginx/conf.d/nginx.conf on Admin server.

1. SSH to Admin server 
2. Open /etc/nginx/conf.d/nginx.conf and edit following lines.
   

   
       ssl_ciphers "AESGCM:-aNULL:-DH:-kRSA:@STRENGTH";   

   
   
3. Restart ngnix service using below command 

    service nginx restart 

The followings are examples.
Output with ssl_ciphers "AESGCM:-aNULL:-DH:-kRSA:@STRENGTH";

Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  TLSv1.2
     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

To restrict AES128, change it to ssl_ciphers "AESGCM:-aNULL:-DH:-kRSA:!AES128:@STRENGTH"; 

Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  TLSv1.2
     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Note: ngnix.conf will be reverted when user perform below operations.

orchestration-cli-client --update-admin-node
Save and Apply configuration on "WebUI [ADMIN]-[System]". 

Editing the cipher under "/var/netwitness/config-management/cookbooks/nw-nginx/templates/default/nw-ui.conf.erb" should retain the changes when user performs above operations.
These changes will still revert when user does upgrade or update. 

Core services: 

It is configured at Admin-Services-'The service which uses the ssl port'-Explore, /sys/config/ssl.cipher.list 
Default value is '-ALL:!aNULL:HIGH' or '-ALL:!aNULL:!DES:!3DES:HIGH'.
For example, to disable DES and 3DES ciphers add '!DES:!3DES' to the field.

For more information, please refer to the openssl ciphers manual page: https://www.openssl.org/docs/man1.0.2/man1/ciphers.html

Default encryption cipher

When a client asks a server, server will select cipher suites from the list which is provided from the client.
And you can check the ordered default cipher preference list by following the command line.

# openssl ciphers -v 'DEFAULT'

How does VLC secure the logs and forward out in detail?

Same with log collector. encrypted SSL port 56001
Between LC and each event source, each protocol has own encryption method. Refer to the 'Log Collector Service' in the Network Encryption
NetWitness Network Encryption: https://community.rsa.com/docs/DOC-105911

Note: About any encryption on log files stored on the local disk, there is no filesystem level encryption, only transport level encryption.

Public Key length (size)

NetWitness 11.x uses 2048 bit or 4096 bit of Public-Key

Customer provided Certificate

To replace the internally generated web server certificate with a customer issued certificate.
Security Configuration Guide for NetWitness Platform Version 11.2: https://community.rsa.com/docs/DOC-96728

    Appendix A: Customer Provided Certificates

System Security and User Management Guide for RSA NetWitness® Platform 11.3: https://community.rsa.com/docs/DOC-101138

    (Optional) Use a Custom Server Certificate